stack-group-aliyun-ros-stack-group-execution-role.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  en: Configure the AliyunROSStackGroupExecutionRole to enable use of your account
    as a target account in Alibaba Cloud ROS StackGroup.
  zh-cn: 配置AliyunROSStackGroupExecutionRole以启用您的帐户作为阿里云ROS资源栈组中的目标帐户。
Conditions:
  CurrentAccount:
    Fn::Equals:
    - Ref: AdministrationAccountId
    - ''
Parameters:
  ExecutionRoleName:
    Type: String
    Description:
      en: Execution role name of target account
      zh-cn: 为目标账号创建执行角色的名称
    Default: AliyunROSStackGroupExecutionRole
  AdministrationAccountId:
    Type: String
    Description:
      zh-cn: 管理员主账号ID，不填则授权给当前账号
      en: Administration account ID. If not, authorize the current account
    Default: ''
Resources:
  AliyunROSStackGroupExecutionRole:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName:
        Ref: ExecutionRoleName
      AssumeRolePolicyDocument:
        Version: 1
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            RAM:
            - Fn::Join:
              - ''
              - - 'acs:ram::'
                - Fn::If:
                  - CurrentAccount
                  - Ref: ALIYUN::TenantId
                  - Ref: AdministrationAccountId
                - :root
  AttachPolicy:
    Type: ALIYUN::RAM::AttachPolicyToRole
    Properties:
      PolicyName: AdministratorAccess
      PolicyType: System
      RoleName:
        Fn::GetAtt:
        - AliyunROSStackGroupExecutionRole
        - RoleName
Outputs:
  ExecutionRoleName:
    Value:
      Fn::GetAtt:
      - AliyunROSStackGroupExecutionRole
      - RoleName
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - ExecutionRoleName
      - AdministrationAccountId
      Label:
        default: RAM
    TemplateTags:
    - acs:example:安全:创建StackGroup目标账号权限